This patch is mainly a naming cleanup to clarify hidden logics, no
functional changes.

acpi_initialize_tables() is used by Linux to install table addresses for
early boot steps.  During this stage, table addresses are mapped by
early_ioremap() mechanism which is different from the runtime IO mappings.
Thus it is not safe for ACPICA to keep mapped pointers in struct acpi_table_desc
structure during this stage.

In order to support this in ACPICA, table states are divided into
1. "INSTALLED" (where struct acpi_table_desc.Pointer is always NULL) and
2. "VALIDATED" (where struct acpi_table_desc.Pointer is always not NULL).
During acpi_initialize_tables(), table state are ensured to be "INSTALLED"
but not "VALIDATED".  This logic is ensured by the original code in very
ambigious way.  For example, currently acpi_tb_delete_table() is invoked in
some place to perform an uninstallation while it is invoked in other place
to perform an invalidation.  They happen to work just because no one enters
the penalty where the 2 behaviours are not equivalent.

The naming cleanups are made in this patch:
A. For installation and validation:
   There is code setting struct acpi_table_desc.Pointer first and delete it
   immediately to keep the descriptor's state as "INSTALLED" during the
   installation.  This patch implements this in more direct way.  After
   applying it, struct acpi_table_desc.Pointer will never be set in
   acpi_tb_install_table() and acpi_tb_override_table() as they are the only
   functions invoked during acpi_initialize_tables(). This is achieved by:
1. Rename acpi_tb_verify_table() to acpi_tb_validate_table() to clarify this
   change.
2. Rename acpi_tb_table_override() to acpi_tb_override_table() to keep nameing
   consistencies as other APIs (verb. Table).
3. Stops setting struct acpi_table_desc.Pointer in acpi_tb_install_table() and
   acpi_tb_table_override().
4. Introduce acpi_tb_acquire_table() to acquire the table pointer that is not
   maintained in the struct acpi_table_desc of the global root table list and
   rewrite acpi_tb_validate_table() using this new function to reduce
   redundancies.
5. Replace the table pointer using the overridden table pointer in
   acpi_tb_add_table(). As acpi_tb_add_table() is not invoked during early boot
   stage, tables returned from this functions should be "VALIDATED".  As
   acpi_tb_override_table() is modified by this patch to return a "INSTALLED"
   but not "VALIDATED" descriptor, to keep acpi_tb_add_table() unchanged,
   struct acpi_table_desc.Pointer is filled in acpi_tb_add_table().
B. For invalidation and uninstallation:
   The original code invalidate table by invoking acpi_tb_delete_table() here
   and there, but actually this function should only be used to uninstall
   tables.  This can work just because its invocations are equivalent to
   invalidation in some cases.
   This patch splits acpi_tb_delete_table() into acpi_tb_invalidate_table() and
   acpi_tb_uninstall_table() and cleans up the hidden logic using the new
   APIs.  This is achieved by:
1. Rename acpi_tb_delete_table() to acpi_tb_uninstall_table() as it is mainly
   called before resetting struct acpi_table_desc.Address.  Thus the table
   descriptor is in "not INSTALLED" state.  This patch enforces this by
   setting struct acpi_table_desc.Address to NULL in this function.
2. Introduce acpi_tb_invalidate_table() to be the reversal of
   acpi_tb_validate_table() and invoke it in acpi_tb_uninstall_table().
3. Introduce acpi_tb_release_table() to release the table pointer that is not
   maintained in acpi_gbl_root_table_list and rewrite acpi_tb_invalidate_table()
   using this new function to reduce redundancies.

After cleaning up, the maintainability of the internal APIs are also
improved:
1. acpi_tb_acquire_table: Acquire struct acpi_table_header according to
                       ACPI_TABLE_ORIGIN_xxx flags.
2. acpi_tb_release_table: Release struct acpi_table_header according to
                       ACPI_TABLE_ORIGIN_xxx flags.
3. acpi_tb_install_table: Make struct acpi_table_desc.Address not NULL according to
                       ACPI_TABLE_ORIGIN_xxx flags.
4. acpi_tb_uninstall_table: Make struct acpi_table_desc.Address NULL according to
                         ACPI_TABLE_ORIGIN_xxx flags.
5. acpi_tb_validate_table: Make struct acpi_table_desc.Pointer not NULL according to
                        ACPI_TABLE_ORIGIN_xxx flags.
6. acpi_tb_invalidate_table: Make struct acpi_table_desc.Pointer NULL according to
                          ACPI_TABLE_ORIGIN_xxx flags.
7. acpi_tb_override_table: Replace struct acpi_table_desc.Address and
                        struct acpi_table_desc.Flags.  It only happens in
                        "INSTALLED" state.

The patch has been unit tested in acpi_exec by:
1. Initializing;
2. Executing exc_tbl ASLTS tests;
3. Executing "Load" command.
So that all original acpi_tb_install_table() and acpi_tb_override_table()
invocations are covered.

Known Issues:
1. Cleanup acpi_tb_add_table() to Kill Code Redundancies
   Current implementation in acpi_tb_add_table() is not very clean, further
   patch can rewrite acpi_tb_add_table() with ordered acpi_tb_install_table(),
   acpi_tb_override_table() and acpi_tb_validate_table(). It is not done in this
   patch so that it is easy for the reviewers to understand the changes in
   this patch.
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

Currently there are following issues in acpi_tb_add_table():
Following logic is currently correct:
1. When a table is allocated in acpi_ex_load_op(), if a reloading happens,
   the allocated memory is freed by acpi_tb_add_table() and AE_OK is
   returned to the caller to avoid the caller to free it again.
Following logic is currently incorrect:
1. When a table is allocated in acpi_ex_load_op() or by the
   acpi_load_table() caller, if the table is already loaded, there will be
   twice ACPI_FREE() called for the same pointer when acpi_tb_add_table()
   returns AE_ALREADY_EXISTS.

This patch only fixes the above incorrect logic in acpi_tb_add_table():
1. Only invoke acpi_tb_delete_table() if AE_OK is going to be returned.
2. After doing so, we do not invoke ACPI_FREE() when returning AE_OK;
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NBob Moore <robert.moore@intel.com>
[rjw: Subject]
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

When table is overridden or reloaded, acpi_tb_delete_table() is called where
struct acpi_table_desc.Pointer will be NULL.  It thus is impossible for virtual
addressed tables to obtain the .Pointer again in acpi_tb_verify_table().

This patch stores virtual table addresses  (ACPI_TABLE_ORIGIN_ALLOCATED,
ACPI_TABLE_ORIGIN_UNKNOWN, ACPI_TABLE_ORIGIN_OVERRIDE) in the
struct acpi_table_desc.Address field and refills the struct acpi_table_desc.Pointer
using these addresses in acpi_tb_verify_table(). Note that if a table with
ACPI_TABLE_ORIGIN_ALLOCATED set is actually freed, the .Address field
should be invalidated and thus must be replaced with NULL to avoid wrong
future validations occuring in acpi_tb_verify_table().
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

The divergences in the ACPICA files makes it difficult to maintain linuxize
ACPICA table commits.  This patch reduces such divergences before applying
table manager commits so that human interventions of patch rebasing can be
reduced.
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
[rjw: Subject]
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

Adds "OriginalSyncLevel" field to the output.
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

This patch cleans up all of the acpi_os_wait_events_complete() invocations to
make it to be invoked inside of ACPICA in the way to accommodate Linux's
work queue implementation.

According to the report, current Linux kernel code is facing a boot time
race issue in the acpi_remove_notify_handler(). This is because:
Linux is using work queues to implement a deferred handler call environment
while ACPICA expects OSPM to implement acpi_os_wait_events_complete() using
wait queues.  The position to invoke a "waiter" is not suitable for a
"flusher" as new invocations can be scheduled after this position and
before the deletion of the handler from its management container.

Since the following commit has deleted acpi_os_wait_events_complete()
parameters, it thus might not be possible for OSPM to achieve a safe
removal using wait queues.  This requires ACPICA to be changed accordingly
to "flush" handlers rather than "wait" them to be drain up:

  Commit: 5ff986a2a9db11858247b71fe242fe17617229aa
  Date: Wed, 16 May 2012 13:36:07 -0700
  Subject: Introduce acpi_os_wait_events_complete interface.

  This interface will block until asynchronous events like notifies
  and GPEs are complete. Within ACPICA, it is called before a notify or GPE
  handler is removed. ACPICA BZ 868.

This patch fixes this issue by invoking acpi_os_wait_events_complete() in the
way to "flush" things - it thus should be put to the position after handler
is removed from its management container but before it is destructed.

The technical concerns are:
1. MTX_NAMESPACE is used to protect things that acpi_os_wait_events_complete()
   might be waiting for, thus MTX_NAMESPACE must be unlocked before
   invoking acpi_os_wait_events_complete().
2. MTX_NAMESPACE is also used to implement the serialization of
   acpi_install_notify_handler() and acpi_remove_notify_handler(). This patch
   changes this logic, thus if there are many
   acpi_install/remove_notify_handler() invoked in parallel, the
   acpi_os_wait_events_complete() might face the races which could cause it
   never running to an end.  Normally this will require additional code to
   implement a separate locking facility which is not implemented due to 3.
3. Given ACPICA users will always invoke acpi_install_notify_handler() once
   during Linux module/device initialization and invoke
   acpi_remove_notify_handler() once during module/device finalization,
   problem stated in 2 will not happen in Linux environment due to the
   mutual exclusive module/device existence, this fix thus is sufficient.
Same concerns can apply to acpi_install/remove_gpe_handler(). Reported and
tested: Ronald Vink.  Fixed: Lv Zheng.

References: https://bugzilla.kernel.org/show_bug.cgi?id=60583Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Reported-and-Tested-by: NRonald Vink <ronald.vink@boskalis.com>
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

For Notify operators, displays a comment that describe the meaning
of the notify value.

This patch updates the debugging information that is enabled for
CONFIG_ACPI_DEBUG builds.
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

For _HID and _CID, the disassembler will emit a string that describes
the device if the _HID/_CID value is recognized. acpihelp updated also.
acpihelp will now search for a specific ID as well as displaying
the list of "known" (to ACPICA) IDs.

This patch does not affect Linux kernel behavior as the disassembler
and the acpihelp are not shipped with it.
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

We would like to see the ASL for any machine that uses this operator,
so emit at least a warning to hopefully draw some attention.
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

Change all comments that contain the string "ACPI CA" to "ACPICA"
so that the name is standard across the entire source base.
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

ACPICA BZ 1077. David Binderman.

References: https://bugs.acpica.org/show_bug.cgi?id=1077Signed-off-by: NDavid Binderman <dcb314@hotmail.com>
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Cc: 3.9+ <stable@vger.kernel.org> # 3.9.x: 42f8fb75: ACPICA: Source restructuring
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

These recently added interfaces did not have these macros, used
by some hosts.
Signed-off-by: NBob Moore <robert.moore@intel.com>
Signed-off-by: NLv Zheng <lv.zheng@intel.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

This patch fixes I/O errors with the sym53c8xx_2 driver when the disk
returns QUEUE FULL status.

When the controller encounters an error (including QUEUE FULL or BUSY
status), it aborts all not yet submitted requests in the function
sym_dequeue_from_squeue.

This function aborts them with DID_SOFT_ERROR.

If the disk has full tag queue, the request that caused the overflow is
aborted with QUEUE FULL status (and the scsi midlayer properly retries
it until it is accepted by the disk), but the sym53c8xx_2 driver aborts
the following requests with DID_SOFT_ERROR --- for them, the midlayer
does just a few retries and then signals the error up to sd.

The result is that disk returning QUEUE FULL causes request failures.

The error was reproduced on 53c895 with COMPAQ BD03685A24 disk
(rebranded ST336607LC) with command queue 48 or 64 tags.  The disk has
64 tags, but under some access patterns it return QUEUE FULL when there
are less than 64 pending tags.  The SCSI specification allows returning
QUEUE FULL anytime and it is up to the host to retry.
Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
Cc: Matthew Wilcox <matthew@wil.cx>
Cc: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch fixes the initialization of an array used in the TX
datapath that was mistakenly initialized together with the
RX datapath arrays. An out of range array access could happen
when RX and TX rings had different sizes.
Signed-off-by: NVincenzo Maffione <v.maffione@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When the device is unplugged, the driver would try to disable the
device. Add checking the flag of RTL8152_UNPLUG to skip setting
the device when it is unplugged. This could shorten the time of
unloading the driver.
Signed-off-by: NHayes Wang <hayeswang@realtek.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The sun4i-emac driver is rather primitive, and doesn't support
promiscuous mode. This makes usage such as bridging impossible,
which is a shame on virtualization capable HW such as the
Allwinner A20.

The fix is fairly simple: move the RX setup code to the ndo_set_rx_mode
vector, and add the required HW configuration when IFF_PROMISC is passed
by the core code.

This has been tested on a generic A20 box running a few virtual
machines hanging off a bridge with the EMAC chip as the link to the
outside world.

Cc: Stefan Roese <sr@denx.de>
Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: NMarc Zyngier <marc.zyngier@arm.com>
Acked-by: NStefan Roese <sr@denx.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch fixes coccinelle error regarding usage of IS_ERR and
PTR_ERR instead of PTR_ERR_OR_ZERO.
Signed-off-by: NDuan Jiong <duanj.fnst@cn.fujitsu.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The code was incorrectly using sg_dma_address() and
sg_dma_len() instead of ib_sg_dma_address() and
ib_sg_dma_len().

This prevents srpt from functioning with the
Intel HCA and indeed will corrupt memory
badly.

Cc: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: NDennis Dalessandro <dennis.dalessandro@intel.com>
Tested-by: NVinod Kumar <vinod.kumar@intel.com>
Signed-off-by: NMike Marciniszyn <mike.marciniszyn@intel.com>
Cc: stable@vger.kernel.org # 3.3+
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Because it doesn't always create, if there's an existing one it just
returns it.
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

These functions are not adding or deleting an lport. They are adding a
wwn that may match with an lport that is present on the system.

Renaming ft_del_lport also means we won't have functions named
both ft_del_lport and ft_lport_del any more.
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Rename struct ft_lport_acl to ft_lport_wwn. "acl" is associated with
something different in LIO terms. Really, ft_lport_wwn is the
fabric-specific wrapper for the struct se_wwn.

Rename "lacl" local variables to "ft_wwn" as well.

Rename list_heads used as list members to make it clear they're nodes, not
heads.

Rename lport_node to ft_wwn_node.

Rename ft_lport_list to ft_wwn_list
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

tcm_fc doesn't support multiple TPGs per wwn. For proof, see
ft_lport_find_tpg. Enforce this in the code.

Replace ft_lport_wwn.tpg_list with a single pointer. We can't fold ft_tpg
into ft_lport_wwn because they can have different lifetimes.
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

Nobody outside tfc_conf.c uses it.
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

ft_del_tpg checks tpg->tport is set before unlinking the tpg from the
tport when the tpg is being removed. Set this pointer in ft_tport_create,
or the unlinking won't happen in ft_del_tpg and tport->tpg will reference
a deleted object.

This patch sets tpg->tport in ft_tport_create, because that's what
ft_del_tpg checks, and is the only way to get back to the tport to
clear tport->tpg.

The bug was occuring when:

- lport created, tport (our per-lport, per-provider context) is
  allocated.
  tport->tpg = NULL
- tpg created
- a PRLI is received. ft_tport_create is called, tpg is found and
  tport->tpg is set
- tpg removed. ft_tpg is freed in ft_del_tpg. Since tpg->tport was not
  set, tport->tpg is not cleared and points at freed memory
- Future calls to ft_tport_create return tport via first conditional,
  instead of searching for new tpg by calling ft_lport_find_tpg.
  tport->tpg is still invalid, and will access freed memory.

see https://bugzilla.redhat.com/show_bug.cgi?id=1071340

Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: NAndy Grover <agrover@redhat.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

This patch addresses an issue that occurs when an ABTS is received
for an se_cmd that completes just before the sess_cmd_list is searched
in core_tmr_abort_task(). When the sess_cmd_list is searched, since
the ABTS and the FCP_CMND being aborted (that just completed) both
have the same OXID, TFO->get_task_tag(TMR) returns a value that
matches tmr->ref_task_tag (from TFO->get_task_tag(FCP_CMND)), and
the Abort Task tries to abort itself. When this occurs,
transport_wait_for_tasks() hangs forever since the TMR is waiting
for itself to finish.

This patch adds a check to core_tmr_abort_task() to make sure the
TMR does not attempt to abort itself.
Signed-off-by: NAlex Leung <alex.leung@emulex.com>
Signed-off-by: NNicholas Bellinger <nab@linux-iscsi.org>

When the Ethernet interface is put down and up with heavy Ethernet
traffic, then there is prossibility of an interrupt waiting in irq
controller to be processed, so when the interface is brought up again
just after enable interrupt, it goes to ISR due to the previous
unhandled interrutp and in ISR napi is not scheduled as the napi
is not enabled in ndo_open which results in disabled interrupt for
CPSW and no packets are received in cpsw. So this patch moves enabling
of interupts after napi_enable and clearing CPDMA interrupts.
Signed-off-by: NMugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When the Ethernet interface is brought down during high Ethernet traffic,
then cpsw creates the following warn dump. When cpdma has already processed
the packet then the status will be greater than 0, so the cpsw_rx_handler
considers that the interface is up and try to resubmit one more rx buffer
to cpdma which fails as the DMA is in teardown process. This can be avoided
by checking the interface state and then process the received packet, if the
interface is down just discard and free the skb and return.

[ 2823.104591] WARNING: CPU: 0 PID: 1823 at drivers/net/ethernet/ti/cpsw.c:711 cpsw_rx_handler+0x148/0x164()
[ 2823.114654] Modules linked in:
[ 2823.117872] CPU: 0 PID: 1823 Comm: ifconfig Tainted: G        W     3.14.0-11992-gf34c4a35 #11
[ 2823.126860] [<c0014b5c>] (unwind_backtrace) from [<c00117e4>] (show_stack+0x10/0x14)
[ 2823.135030] [<c00117e4>] (show_stack) from [<c0533a9c>] (dump_stack+0x80/0x9c)
[ 2823.142619] [<c0533a9c>] (dump_stack) from [<c003f0e0>] (warn_slowpath_common+0x6c/0x90)
[ 2823.151141] [<c003f0e0>] (warn_slowpath_common) from [<c003f120>] (warn_slowpath_null+0x1c/0x24)
[ 2823.160336] [<c003f120>] (warn_slowpath_null) from [<c03caeb0>] (cpsw_rx_handler+0x148/0x164)
[ 2823.169314] [<c03caeb0>] (cpsw_rx_handler) from [<c03c730c>] (__cpdma_chan_free+0x90/0xa8)
[ 2823.178028] [<c03c730c>] (__cpdma_chan_free) from [<c03c7418>] (__cpdma_chan_process+0xf4/0x134)
[ 2823.187279] [<c03c7418>] (__cpdma_chan_process) from [<c03c7560>] (cpdma_chan_stop+0xb4/0x17c)
[ 2823.196349] [<c03c7560>] (cpdma_chan_stop) from [<c03c766c>] (cpdma_ctlr_stop+0x44/0x9c)
[ 2823.204872] [<c03c766c>] (cpdma_ctlr_stop) from [<c03cb708>] (cpsw_ndo_stop+0x154/0x188)
[ 2823.213321] [<c03cb708>] (cpsw_ndo_stop) from [<c046f0ec>] (__dev_close_many+0x84/0xc8)
[ 2823.221761] [<c046f0ec>] (__dev_close_many) from [<c046f158>] (__dev_close+0x28/0x3c)
[ 2823.230012] [<c046f158>] (__dev_close) from [<c0474ca8>] (__dev_change_flags+0x88/0x160)
[ 2823.238483] [<c0474ca8>] (__dev_change_flags) from [<c0474da0>] (dev_change_flags+0x18/0x48)
[ 2823.247316] [<c0474da0>] (dev_change_flags) from [<c04d12c4>] (devinet_ioctl+0x61c/0x6e0)
[ 2823.255884] [<c04d12c4>] (devinet_ioctl) from [<c045c660>] (sock_ioctl+0x68/0x2a4)
[ 2823.263789] [<c045c660>] (sock_ioctl) from [<c0125fe4>] (do_vfs_ioctl+0x78/0x61c)
[ 2823.271629] [<c0125fe4>] (do_vfs_ioctl) from [<c01265ec>] (SyS_ioctl+0x64/0x74)
[ 2823.279284] [<c01265ec>] (SyS_ioctl) from [<c000e580>] (ret_fast_syscall+0x0/0x48)
Signed-off-by: NMugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Several spots in the kernel perform a sequence like:

	skb_queue_tail(&sk->s_receive_queue, skb);
	sk->sk_data_ready(sk, skb->len);

But at the moment we place the SKB onto the socket receive queue it
can be consumed and freed up.  So this skb->len access is potentially
to freed up memory.

Furthermore, the skb->len can be modified by the consumer so it is
possible that the value isn't accurate.

And finally, no actual implementation of this callback actually uses
the length argument.  And since nobody actually cared about it's
value, lots of call sites pass arbitrary values in such as '0' and
even '1'.

So just remove the length argument from the callback, that way there
is no confusion whatsoever and all of these use-after-free cases get
fixed as a side effect.

Based upon a patch by Eric Dumazet and his suggestion to audit this
issue tree-wide.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

ws2008r2 does not support UDP checksum offload. Thus, we cannnot turn on
UDP offload in the host. Also, on ws2012 and ws2012 r2, there appear to be
an issue with UDP checksum offload.
Fix this issue by computing the UDP checksum in the Hyper-V driver.

Based on Dave Miller's comments, in this version, I have COWed the skb
before modifying the UDP header (the checksum field).
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Ws2008R2 supports ndis_version 6.1 and 6.1 is the minimal version required
for various offloads. Negotiate ndis_version 6.1 when on ws2008r2.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

An outgoing packet can potentially need per-packet information for
all the offloads and VLAN tagging. Fix this issue.
Signed-off-by: NK. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: NHaiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Remove the bonding debug_fs entries when the
module initialization fails. The debug_fs
entries should be removed together with all other
already allocated resources.
Signed-off-by: NThomas Richter <tmricht@linux.vnet.ibm.com>
Signed-off-by: NJay Vosburgh <j.vosburgh@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

A recent change broke the RSS LUT programming, causing it to be
programmed with all 0. Correct this by actually assigning the
incremented value back to the counter variable so that the increment
will be remembered by the calling function.

While we're at it, add a proper kernel-doc function comment to our
helper function.
Signed-off-by: NMitch Williams <mitch.a.williams@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NFrancois Romieu <romieu@fr.zoreil.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: NSibai Li <sibai.li@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NFrancois Romieu <romieu@fr.zoreil.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: NPhil Schmitt <phillip.j.schmitt@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NFrancois Romieu <romieu@fr.zoreil.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

last_rx_timestamp should be updated only when rx time stamp is
read. Also it's only used with NICs that have per-interface time
stamping resources so it can be moved to adapter structure and
set in igb_ptp_rx_rgtstamp().
Signed-off-by: NJakub Kicinski <kubakici@wp.pl>
Acked-by: NMatthew Vick <matthew.vick@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NFrancois Romieu <romieu@fr.zoreil.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NFrancois Romieu <romieu@fr.zoreil.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>

Signed-off-by: NFrancois Romieu <romieu@fr.zoreil.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: NAaron Brown <aaron.f.brown@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>